Anthropic-Cybersecurity-Skills/skills/hunting-for-defense-evasion-via-timestomping/SKILL.md

name, description, domain, subdomain, tags, version, author, license

name	description	domain	subdomain	tags	version	author	license
hunting-for-defense-evasion-via-timestomping	Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT. Uses analyzeMFT and Python to identify files with anomalous temporal patterns indicating anti-forensic timestomping activity.	cybersecurity	threat-hunting	timestomping ntfs-forensics mft-analysis defense-evasion	1.0	mahipal	Apache-2.0

Hunting for Defense Evasion via Timestomping

Detect timestamp manipulation by analyzing NTFS MFT entries for discrepancies between $STANDARD_INFORMATION and $FILE_NAME attributes.